In the control system used particularly for controlling the plant facilities and the like, it may be difficult to take security measures such as anti-virus software which is commonly used, because of time constraints on executions of control operations, constraints on a processing capability of a control apparatus which constitutes the control system, and other constraints.
On the other hand, a method for detecting an abnormality in a network on the basis of statistical analysis of traffic data is disclosed in Patent Document 1 as a method for detecting an abnormal communication from communication packets which are collected on a network. In addition, a method for detecting an abnormality in a network by detecting a traffic flow which is different from what is defined in traffic rules is disclosed in Patent Document 2.